chore: remove iam role attributes from CloudTrail if Config org enabl…

…ed (#1456)
lacework · Nov 17, 2023 · cbbcb1f · cbbcb1f
1 parent 6f7ced5
commit cbbcb1f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lwgenerate/aws/aws.go b/lwgenerate/aws/aws.go
@@ -929,7 +929,7 @@ func createCloudtrail(args *GenerateAwsTfConfigurationArgs) (*hclwrite.Block, er
 			attributes["sqs_encryption_enabled "] = false
 		}
 	}
-	if args.ExistingIamRole.IsEmpty() && args.Config {
+	if args.ExistingIamRole.IsEmpty() && args.Config && !args.AwsOrganization {
 		attributes["use_existing_iam_role"] = true
 		attributes["iam_role_name"] = lwgenerate.CreateSimpleTraversal(
 			[]string{"module", "aws_config", "iam_role_name"})